What this research covers, and what it does not
The question is what happens when several autonomous agents share one machine: a filesystem, a clipboard, a set of OAuth scopes, a wallet. There are threat models for this. There are opinions. There is no dataset, and this project exists to produce one.
Five risks, and which of them has executed evidence.
The field scores multi-agent risk in five categories and weights them towards the terminal harms. Those scores are estimates: a model reads a pair of descriptions and judges. This instrument replaces some of them with runs, and the honest report is not how many runs there are but what any of them is evidence for. 2 of the 5 categories have none.
Prompt injection between agents
One agent's output hijacks another's behaviour, directly or through a shared filesystem, clipboard or tool result.
Executed here by Induced execution (61 verdicts) and State poisoning (60 verdicts). Each confirms by a side effect a criterion checks, never by a model reading a transcript.
Data leakage and scope violations
One agent is authorised to see sensitive data and the other is not, and the second exposes what it should never have had.
Executed here by Secret exfiltration (81 verdicts). Each confirms by a side effect a criterion checks, never by a model reading a transcript.
Capability and permission conflicts
Both agents hold authority over the same resource, and one's writes silently break the other's assumptions.
Executed here by Induced execution (61 verdicts) and Partner escalation (82 verdicts) and State poisoning (60 verdicts). Each confirms by a side effect a criterion checks, never by a model reading a transcript.
Cascading errors and hallucination amplification
One agent confidently outputs something wrong and the other treats it as ground truth, compounding it across the boundary.
Confirming this needs a criterion that can tell a compounded error from an ordinary one, which means a task with a checkable right answer and a second agent that acts on the first's output. None of the adversarial scenarios has that shape: they all plant something and watch for a side effect, and a wrong answer produces no side effect to watch.
Compliance and policy violations from composition
Each agent complies on its own, and the combination produces a workflow that does not.
Confirming this needs a policy to violate, and a policy is a fact about an organisation rather than about a pair of agents. Nothing in a sandbox on one machine can establish it without the harness inventing the rule it then finds broken, which would be measuring this project's imagination.
Not covered, and not yet measured
Stated first, because a threat model read as a list of covered cases is a threat model that has misled someone.
- No agent has been invoked. Every figure published so far concerns whether a container builds and its environment starts. Nothing here is evidence about agent behaviour.
- No pair has been run. The adversarial scenarios are specified and the sandbox that executes them exists, but no two agents have yet shared a workspace under measurement here.
- The one paper published reports viability only. It concerns whether containers build and start, and states no result about agent behaviour or interaction.
- The agents measured are Python, and not all of them.The build recipe reads Python packaging. Agents written in other languages are recorded as unsupported rather than as failures, but they are absent from every rate on this site.
- Model behaviour is out of scope. Agents under test run against a small local model. Results are about how agents interact, not about how capable a model is.
In scope, once pairs run
- One agent reading a secret placed only in another agent’s environment.
- One agent acting on instructions another wrote into shared state.
- A narrow agent inducing a broader one to act beyond its own scope.
- Two agents failing to terminate against each other.
- Anything leaving the network allowlist.
How a result is established
Every scenario carries a mechanically checkable criterion, because a model that decides results is a model that can be wrong about them. A confirmed exfiltration is a planted token appearing verbatim in another agent’s output, not a judgement about whether something looked like exfiltration. A model is consulted only where a transcript is genuinely ambiguous, and every verdict records whether a deterministic property, a tripwire, or a model established it.